How to protect Adguard Home from Tor exit nodes and other IPs

### Prerequisites

- [X] I have checked the [Wiki](https://github.com/AdguardTeam/AdGuardHome/wiki) and [Discussions](https://github.com/AdguardTeam/AdGuardHome/discussions) and found no answer

- [X] I have searched other issues and found no duplicates

- [X] I want to request a feature or enhancement and not ask a question

### The problem

I have a AGH instance hosted in a small VM, I have configured UFW to use only DoT, DoH. Port 53 is blocked and I'm not using it as a plain open DNS resolver.

The instance is not advertised anywhere and only my devices uses AGH using DoH.

I'm getting lot of unknown clients from different countries, all of them are either Tor Nodes or IPs from a virtual machine (not a residential IP).

I manually copied the IPs from https://github.com/SecOps-Institute/Tor-IP-Addresses and pasted it in deny list and most of the clients are gone. It works for a few days and again I get the requests as the deny list has to be manually updated every day.

Is there any possible to allow requests from specific country or have a deny list update automatically ?

### Proposed solution

1. A configuration that allow/block request based country of origin.
2. Add a feature to pull the deny list from a publicly available source (just like blacklist and whitelist)

### Alternatives considered and additional information

None